---
typeId: req
recordId: benac-io-001
fields:
  title: Local package import
  statement: |
    Benac shall import packages from a Package Bundle ZIP file.

    A Package Bundle ZIP file shall contain a required Package Bundle Manifest at `bundle/package_bundle_manifest.json`.

    A Host Implementation shall not import a standalone package document JSON file, standalone package bundle JSON file, standalone package bundle manifest JSON file, standalone schema JSON file, standalone fixture JSON file, standalone report JSON file, standalone claim JSON file, standalone raw blob file, or standalone CID index JSON file as a package.

    Package document JSON, package bundle JSON, package bundle manifest JSON, schema JSON, fixture JSON, report JSON, claim JSON, and raw blob files shall enter package import semantics only as declared entries inside a Package Bundle ZIP file.

    Package import shall compute and verify the package CID, Package Bundle Manifest CID, included structured document CIDs, and included raw blob CIDs before recording package import success.

    Package import shall create a package import record on success.

    Package import shall create a package import failure record on failure.

    Package import shall not grant trust, capability authority, blob retrieval authority, storage authority, compute authority, package approval, or execution authority.
  rationale: >-
    Package authors and independent Host Implementations need one physical
    package import artifact. A Package Bundle ZIP file gives browser and
    desktop hosts a single selectable package file while preserving package
    identity as the package CID and distribution context as the Package Bundle
    Manifest.
  verification: >-
    Conformance tests import the same valid Package Bundle ZIP file on Browser
    PWA, Ubuntu, macOS, and Windows Host Implementations. Each Host
    Implementation computes the same package CID, Package Bundle Manifest CID,
    structured document CIDs, raw blob CIDs, fixture discovery result, artifact
    availability result, inspection result, diagnostics, and package import
    record. Tests also prove that standalone package document JSON, standalone
    package bundle JSON, standalone package bundle manifest JSON, standalone
    schema JSON, standalone fixture JSON, standalone report JSON, standalone
    claim JSON, standalone raw blob files, and standalone CID index JSON files
    are rejected as package import artifacts with stable diagnostics and raw
    diagnostic evidence handling.
  testable: true
  status: draft
  area: BENAC-IO
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.15 Import, export, package bundles, and decentralized distribution
  order: 163
---
